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ABSTRACT 
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This  document  has  been  prepared  in  partial  fulfillment  of  CDRL  line  item  A004 
of  System  Development  Corporation's  Air  Force  Global  Weather  Central  System 
Architecture  Study  contract.  Efforts  for  this  report  were  expended  under  Task 
6,  "Conceptual  Design  and  Development  Plan",  performed  under  contract  F04701- 
7 5-C-01 1 4 for  SAKSO,  undfr  ihe  direction  of  Col  ft.  J,  Fox,  VOA. 

The  purpose  of  this  study  has  been  to  optimize  the  entire  AFGWC  data  processing 
system  from  the  vantage  point  of  current  and  future  support  requirements,  ad- 
dressing the  AFGWC  data  processing  system  over  the  1977  through  1982  time  frame. 
This  study  was  performed  under  a unique  plan  which  allows  complete  traceability 
between  user  requirements,  Air  Force  Global  Weather  Central  operational  func- 
tions, requirements  levied  upon  the  data  system,  a proposed  component  configu- 
ration which  meets  the  data  system  requirements,  and  a system  specification 
designed  to  acquire  a system  which  meets  these  requirements. 


The  resultant  system  described  has  a number  of  unique  features,  including  total 
hardware  authentication  separation  of  security  levels,  load  leveling  accomplished 
by  assigning  main  processors  in  accordance  with  a dynamic  priority  queue  of 
tasks,  and  a system-wide  network  control  capability.  Other  key  features  include 
a central  data  base  processor  to  fill  requests  for  data  from  other  processors, 
computer  operations  centers,  the  use  of  array  processors  for  accomplishing  dif- 
ficult numerical  problems,  and  sophisticated  forecaster  console  support.  These 
elements  have  been  designed  to  provide  99.5%  reliability  in  meeting  user 
requirements. 


The  proposed  system  architecture  consists  of  five  dual  processors  each  of  which 
is  about  3.5  times  as  powerful  as  an  existing  AFGWC  processor  (a  Univac  1108). 
Each  dual  processor  has  an  array  processor  which  will  be  capable  of  very  high 
performance  on  vector  arithmetic.  The  array  processors  are  used  to  assist  on 
the  difficult  numerical  problems,  including  the  Advanced  Prediction  Model  for 
the  global  atmosphere,  as  well  as  very  fine  grid  cloud  models  and  cloud  proba- 
bility models.  Some  of  the  new  requirements  that  will  be  supported  with  this 
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system  are  a one  minute  response  to  query  interface,  reentry  support  for 
'linuteman,  and  limited  processing  of  high  resolution  (0.3  nautical  mile)  meteo- 
rological satellite  data.  In  addition,  cloud  cover  prediction  for  tactical 
weapon  systems,  ionospheric  prediction  for  radio  frequency  management,  and 
defense  radar  interference  prediction  will  be  supported  by  this  system. 


Volumes  of  this  final  System/Subsystem  Summary  Report  are  as  follows: 
Volume  1 - Executive  Summary 

Volume  2 - Requirements  Compilation  and  Analysis  (Parts  1,  2,  and  3) 
Volume  3 - Classified  Requirements  Topics  (Secret) 

Volume  4 - Systems  Analysis  and  Trade  Studies 
Volume  5 - System  Description 
Volume  6 - Aerospace  Ground  Equipment  Plan 
Volume  7 - Implementation  and  Development  Plans 
Volume  8 - System  Specification 


This  Executive  Summary  volume,  as  the  name  implies,  provides  an  overview  of  the 
study  and  its  results.  This  overview  has  been  constructed  as  an  introduction 
to  the  more  detailed  discussion  in  Volume  5 but  also  as  a self  contained 
description  for  readers  who  do  not  wish  to  go  into  more  technical  depth. 
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1.0  STUDY  SUMMARY 

This  section  addresses  a variety  of  topics  not  covered  elsewhere  within  the 
volumes.  It  identifies  study  participants  and  general  study  structure.  It 
identifies  the  contents  of  the  volumes  and  finally  addresses  the  important 
topic  of  traceability  within  the  volumes. 

1.1  SDC  TFAM 

The  AFGWC  System  Architecture  was  under  the  project  managership  of  Howard 
Johnson  who  reports  to  Don  Biggar,  Program  Manager  of  the  SDC  Satellite  Control 
Program.  Ron  Knight  worked  very  closely  with  Mr.  Johnson  in  this  pioject.  The 
principal  investigators  throughout  the  project  were  Gary  Billerbeck  (head  of 
tasks  2,  3 and  4),  Dick  Bilek  (head  of  tasks  1 and  6),  D.  L.  Chapman  (head  of 
task  5),  Jim  Wilson  (responsible  for  satellite  data  processing,  and  automated 
work  centers),  Steve  Jermaine  (responsible  for  forecaster  console  design,  net- 
work analysis,  and  the  final  AGE  Plan).  Other  major  participants  include  A1 
Tucker,  Jerry  Peterka,  Bill  Patterson,  Dave  Wexler  and  Bob  Von  Buelow.  For 
specific  problems,  we  received  support  from  John  Evensen,  Jerry  Cole,  Jon 
Fellows,  and  Jack  Lagas.  The  task  of  preparing  briefings  and  project  reports 
was  the  responsibility  of  many  people  but  primarily  Rita  Del  Rey,  Joyce  Ford, 
Diane  Kilpatrick,  Jo  Marie  Tkac,  Wayne  Shook,  John  MacDonald  and  others  in  the 
Satellite  Control  Program. 


1.2  STUDY  APPROACH 

The  SDC  architectural  study  was  broken  into  six  tasks  as  follows: 

a.  Task  1 . The  purpose  of  this  task  was  to  analyze  user  requirements, 
identify  resulting  AFGWC  functions  and,  using  this  analysis,  to  assess 
system  data  processing  oriented  requirements.  The  sheer  volume  of 
user  requirements  and  lack  of  specific  definition  prolonged  this  task 
beyond  what  was  anticipated.  The  output  is  a specification  of  the 
data  system  requirements  which  must  be  satisfied  to  perform  the  AFGWC 
mission  as  interpreted  through  user  requirements. 
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b.  Task  2.  The  purpose  of  this  task  was  to  survey  vendor  products.  The 
1977  baseline  system  was  defined  and  all  viable  options  for  the  final 
configuration  were  identified.  We  identified  design  concepts  for  the 
data  system  with  emphasis  on  control  of  resources,  run  execution  and 
intercommunication  protocol.  The  results  of  task  2 were  in  the  form 
of  a network  of  options  which  were  to  be  analyzed  and  reduced  to  a 
single  cohesive  data  system. 

c.  Task  3.  In  this  task  we  developed  and  applied  criteria  to  evaluate 
the  many  options  which  existed.  The  collection  of  studies  resulting 
from  this  investigation  were  formed  into  the  Systems  Analyses  and 
Trade  Studies  document  (Volume  4).  Each  tradeoff  decision  resulted 
in  a simplification  of  the  analysis  which  remained,  thereby  bringing 
us  closer  to  the  final  system. 

d.  Task  4.  This  task  consisted  of  thoroughly  documenting  the  system  re- 
sulting from  the  tradeoff  studies.  An  analysis  was  made  to  insure  the 
system  would  meet  all  user  requirements.  System  operations  character- 
istics were  determined.  A timing  analysis  was  performed  to  develop  a 
timing  budget.  Similarly,  a reliability  budget  was  developed. 

Finally  a risk  analysis  was  performed  on  the  system.  All  of  these 
became  a part  of  the  System  Specification  (Volume  8). 

e.  Task  5.  This  task  involved  documenting  the  system  architecture  in  a 
System  Specification.  The  System  Specification  was  structured  to  be 
similar  to  the  architectural  domain.  All  requirements  to  be  satisfied 
were  identified  and  the  correlation  between  the  System  Specification 
and  specific  tradeoff  studies  was  established. 

f.  Task  6.  This  task  involved  the  preparation  of  the  final  report.  The 
final  report  includes  all  previously  published  documents  as  well  as: 
a)  the  results  of  tasks  1-4  in  the  form  of  a Requirement  Compilation 
and  Analysis  document  and  a System  Description  document,  b)  an  Execu- 
tive Summary  and  c)  an  Implementation  and  Development  Plan  which 
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identifies  the  schedules  associated  with  design  and  development 
activities,  logistics  of  system  implementation,  a final  analysis  of 
total  system  costs,  a detailed  risk  analysis,  and  a plan  for  verifi- 
cation of  the  system. 

f.  Final  Presentation.  SDC  has  taken  the  briefing  material  prepared  for 
the  four  formal  meetings  and  developed  a final  briefing  for  presenta- 
tion to  Headquarters,  Air  Weather  Service  and  other  Air  Force 
organizations. 

1.3  AIR  FORCE  PARTICIPATION 

The  SDC  role  involved  the  assimilation  of  massive  amounts  of  data.  The  process 
of  design  was  often  based  on  conjecture  in  cases  where  detailed  knowledge  was 
not  available  to  the  investigators.  Air  Force  support  compensated  for  this 
deficit.  SDC  received  extensive  support  from  Col.  Fox  and  Capt.  Piddington  in 
their  role  as  contract  monitors.  They  responded  immediately  to  all  the  requests 
for  information  and  requests  for  access.  They  were  quite  successful  in  expe- 
diting of  all  phases  of  information  flow.  The  single  most  valuable  interface 
at  Air  Force  Global  Weather  Center  was  Lt.  Col.  Coburn  who  was  an  essential  ad 
hoc  member  of  the  SDC  team  continually  contributing  and  enhancing  information 
flow.  The  Commander  and  his  staff  at  Global  Weather  Central  were  extremely 
helpful  as  were  each  of  the  branch  chiefs.  Others  who  were  particularly  helpful 
were  Col.  Blunk,  Lt.  Col.  Flattery,  Lt.  Col.  Ramsey,  Lt.  Col.  West,  Maj.  Craw, 
i Maj.  Diercks,  Capt.  Lewis,  Capt.  Canipe,  Capt.  Cotnoir,  Capt.  Simms  and  numerous 
others.  It  is  obvious  that  AFGWC  is  an  organization  which  takes  great  pride  in 
all  aspects  of  its  wor* . as  much  in  development  as  in  operations. 

1.4  CONTENTS  OF  VOLUMES 

a.  Volume  1,  Executive  Summary.  This  volume  provides  a complete  review 
of  the  architectural  study  with  an  overview  of  the  study  approach,  the 
key  results  from  each  task,  a summary  of  the  selected  hardware  config- 
uration and  discussion  of  the  management  and  operation  of  that  system. 
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Volume  2,  Requirements  Compilation  and  Analysis.  Included  in  this 
volume  are  the  results  of  the  Task  1 investigation  and  a summary  of 
all  user  requirements  including  the  numerical  model  analysis.  The 
document  also  contains  a complete  functional  description  of  tasks  to 
be  performed  at  Global  Weather  Central,  phased  according  to  the  year 
of  their  introduction.  The  final  part  of  the  document  contains  the 
results  of  the  analysis  of  requirements  and  functions  to  determine 
the  data  system  characteristics  to  be  satisfied  by  the  architecture. 
The  network  analysis  showing  the  dynamics  of  system  usage  was  espe- 
cially important  in  that  it  provided  the  information  for  a statistical 
conflict  analysis  primarily  for  the  computer  selection  decision. 


Volume  3,  Classified  Requirements  Topics.  A description  of  the  clas- 
sified requirements  and  any  analysis  classified  by  virtue  of  require- 
ment association  is  contained  in  this  volume. 


Volume  4,  System  Analyses  and  Trade  Studies.  This  volume  provides 
some  100  tradeoff  studies  accomplished  in  developing  the  final 
architectural  design. 


Volume  5,  System  Description.  The  nominal  theoretical  system  de- 
signed by  SDC  is  described.  This  system  complies  with  the  system 
specification  and  is  thought  to  be  realizable  under  state  of  the  art 
hardware  and  software.  The  volume  contains  a description  of  that 
system  and  identifies  operational  characteristics.  It  takes  the 
reader  through  important  design  considerations  and  rationale  not 
covered  in  the  trade  studies. 


Volume  6,  Aerospace  Ground  Equipment  Plan.  This  volume  identifies 
maintenance  approaches.  It  provides  a typical  framework  for  a final 
AGE  plan,  it  deals  with  all  relevant  levels  of  maintenance  including 
preventive,  failure  response,  and  depot  maintenance. 
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g.  Volume  7,  Implementation  and  Development  Plan.  Topics  pertinent  to 
the  procurement  of  the  prescribed  architectural  data  system  are  dis- 
cussed in  this  volume.  A proposed  design  and  development  schedule, 
which  also  treats  phaseover,  is  an  important  part.  The  logistics 
of  implementation  are  described.  There  is  a total  system  cost  analysis 
and  summary  which  details  the  estimated  time  phased  expenditure 
associated  with  the  acquisition  and  development  of  the  architecture 
as  well  as  on-going  cost  considerations.  The  volume  contains  a risk 
analysis  associated  with  the  three  obvious  risk  factors:  the  risk 

of  changing  requirements,  the  probability  of  vendors  providing  a 
system  which  meets  the  performance  specification,  and  also  the  risk 
associated  with  schedules.  Also  addressed  is  the  risk  of  unknown 
factors.  The  final  part  of  this  volume  deals  with  system  verification 
planning  including  a discussion  of  checkout  of  components  both  hardware 
end  software,  system  testing  and  final  integration  testing. 


h.  Volume  8,  System  Specification.  This  volume  provides  a total  set  of 
specifications  to  be  used  in  acquisition  of  the  proposed  architecture 
system.  It  not  only  contains  identification  of  the  hardware  and  soft- 
ware but  also  addresses  personnel,  management  and  facility 
considerations. 

1.5  TRACEABILITY 

1.5.1  Study  Structure 

A Study  Structure  aspect  of  SDC's  study  approach  and  a key  item  of  Air  Force 
concern  throughout  the  architectural  study  has  been  traceability.  SDC  provides 
traceability  through  development  of  standard  orientations  using  hierarchical 
structures.  We  felt  that  the  optimum  number  of  such  orientations  (which  we 
call  domains)  which  provide  a reasonably  uncomplicated  link  for  reference 
consists  of  four  basic  structures,  plus  time  considerations,  as  follows: 
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a.  The  Requirements  Domain.  This  category  gives  a breakdown  of  users 

into  different  types  of  missions  and  identifies  the  individual  require- 
ments associated  with  each  user. 


b. 


The  Functional  Domain.  In  this  domain  all  data  system  associated 
functions/tasks  have  been  categorized  into  four  separate  headings: 
input,  computation,  output  and  support.  The  next  level  of  the 
hierarchy  is  motivated  by  physical  or  product  structure  and,  below 
that,  the  individual  tasks  which  are  part  of  the  system.  Finally, 
task  descriptions  are  the  lowest  part  of  the  hierarchy  identifying 
each  sequence  of  steps  (or  potential  sequence  of  steps)  required  to 
do  a job. 


The  Characteristic  Domain.  This  hierarchy  breaks  down  the  data  system 
into  categories  which  describe  a data  system  structure.  The  highest 
level  corresponds  to  components.  Below  the  first  level  are  character- 
istics attributable  to  components  but  not  necessarily  uniquely 
defining  those  components  (e.g.,  a storage  requirement  might  be 
satisfied  by  tape,  disk,  drum  or  core,  or  all  four,  and  a computation 
requirement  could  be  satisfied  by  many  sizes  of  computers  within  the 
system  and  perhaps  even  by  firmware).  This  domain  makes  no  assumptions 
about  components  which  currently  do  the  job  or  about  which  components 
might  be  selected,  but  tries  to  put  information  in  a form  that  all 
options  are  open.  The  lowest  level  of  this  domain  consists  of 
questions  to  be  asked  to  obtain  the  data  necessary  to  describe  a 
systems  characteristics. 


d. 


The  Architectural  Domain.  The  architectural  domain  is  a hierarchy 
which  specifies  the  components  of  the  architecture.  It  includes 
hardware  (e.g.,  data  storage,  processors)  and  also  software,  manage- 
ment, facilities  and  personnel.  It  identifies  each  component  to  the 
depth  of  the  System  Specification. 
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e.  Time  Considerations.  Since  AFGWC  requirements  change  from  year  to 
year  and  since  the  architecture  components  involve  a staggered 
implementation  sequence,  we  cannot  ignore  the  dimension  of  time 
associated  with  each  of  the  domains  provided  above.  Requirements 
each  have  a date  of  implementation  but  we  only  need  worry  about  the 
significant  ones  which  have  an  impact  on  the  data  system.  Corre- 
spondly,  functions  will  be  incorporated  as  a result  of  the  require- 
ments. The  characteristics  follow  suit  and  this  dictates  when  the 
components  need  to  be  available.  Other  considerations  in  phaseover 
and  implementation  planning  finally  determine  when  they  actually  are 
implemented. 


1.5.2  Application  of  Domain  Structure  to  Study  Documentation 


This  section  describes  how  these  hierarchical  structures  are  used  as  a basis 
for  traceability  within  the  study  documentation.  First,  the  relationships 
between  domain  hierarchies  must  be  identified.  A list  was  developed  which 
links  requirements  with  functions.  (The  number  of  relationships  is  on  the 
order  of  the  list  size;  however  some  requirements  pertain  to  several  functions, 
and  conversely.)  The  link  between  data  system  characteristics  and  AFGWC 
functions  is  one  of  a matrix  rather  than  a list  (since  the  relationships  are 
of  the  order  of  the  square  of  the  list  size).  Theoretically,  all  characteristics 
associated  with  each  task  must  be  accounted  for.  Conversely,  any  single 
characteristic  must  be  evaluated  across  all  tasks.  This  unfortunately  produced 
a 10,000  element  matrix  which  was  too  large  to  complete.  Instead,  the  sig- 
nificant characteristics  which  pertain  to  any  given  task  were  chosen.  It  was 


recognized  that  many  tasks  have  no  effect  on  certain  characteristics. 


With  these  basic  structures  and  their  relationships  in  mind,  we  can  discuss 
the  AFGWC  architectural  study  documentation  and  define  the  relationship  between 
that  documentation  and  our  structures: 
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Requirements  Compilation  and  Analysis  Document.  This  document  is 
organized  according  to  the  requirements  domain.  It  provides  informa- 
tion about  all  requirements  and  models.  It  addresses  the  derived 
general  systems  requirements,  including  reliability,  maintainability 
and  growth.  For  each  requirement,  the  link  with  the  functional  domain 
is  identified.  In  addition,  there  is  a matrix  which  relates  all 
functions  with  all  requirements.  The  requirements  document  also 
defines  the  functional  domain  at  the  task  level  on  a time  phased 
basis.  The  characteristic  analysis  is  a matrix  which  relates  functions 
to  characteristics  and  yields  a summary  of  requirements  related  to 
the  data  system.  It  is  organized  according  to  the  characteristics 
domain.  The  link  to  requirements  is  accomplished  by  simply  scanning 
the  list  of  function  oriented  characteristics  which  contribute  to 
the  characteristic  identified. 

System  Analysis  and  Trade  Studies.  This  document  is  basically  ordered 
by  the  architectural  domain  and  the  study  numbers  are  assigned  accord- 
ingly so  that  an  immediate  correspondence  can  De  made.  For  each  study 
a reference  is  provided  to  requirements  and  functions.  In  addition, 
there  is  a matrix  for  specifically  identifying  the  system  specifica- 
tions resulting  from  the  tradeoff  study.  Also  included  is  the  analysis 
of  new  products.  This  is  presented  in  the  form  of  the  component 
domain . 

AGE  Plan.  The  AGE  plan  is  constructed  in  two  parts.  The  first  part 
pertains  to  type  one  maintenance  or  a preventive  maintenance  program. 

It  is  addressed  in  the  document  functionally  and  in  the  exact  organi- 
zation of  the  functional  domain.  The  second  half  of  the  document 
pertains  to  unscheduled  corrective  maintenance  functions,  and  is 
organized  according  to  the  architectural  domain. 
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d. 


System  Specification  Document.  Generally,  subsystems  are  specified 
according  to  the  structure  of  the  architectural  domain.  In  some 
places,  however,  the  documentation  instruction  for  system  specifica- 
tions would  not  allow  us  to  retain  the  architectural  domain  structure. 
In  these  instances,  a correlation  table  is  provided  which  gives 
the  relationships  between  paragraphs  and  the  architectural  domain. 

In  addition,  the  specifications  are  independently  numbered  according 
to  the  architectural  domain  system  (thereby  providing  total  trace- 
ability).  There  is  also  a matrix  within  the  System  Specification 
which  gives  system  specification  number  and  corresponding  tradeoff 
studies. 


(Page  10  is  Blank) 


1 


2.0  ARCHITECTURAL  SUMMARY 


2.1  REQUIREMENTS  ANALYSIS 


In  Task  1 SOC  investigated  requirements  in  the  areas  of:  command  and  control 
systems,  emergency  war  order  support,  environment  support,  space  environment 
support,  and  special  activities  (primarily  classified).  We  also  investigated 
requirements  in  general  areas  such  as  growth,  manpower  productivity,  reliability 
and  maintainability.  The  requirements  which  were  considered  to  be  key  in 
their  impact  on  data  system  design  are  as  follows: 


General  system  key  requirements: 
Overall  system  security  (internal), 


System  reliability. 
System  growth,  and 
Manpower  productivity. 


b.  User  products  key  requirements  (listed  sequentially  by  requirement 
number) : 


Remotely  piloted  vehicle  systems, 
Electro  optical  weapons  systems, 
Space  optical  imaging  systems, 
High  energy  laser  systems. 

Program  D, 

Agency  B, 

Use  of  ZOOM, 

WWMCCS  support, 

TAC  support, 

AWACS , 

Crisis  management. 

Computer  flight  plans, 

SAC  Minuteman, 
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c. 


Satellite  Imagery  Dissemination, 
Interactive  Processing  and  Display  System, 
Operational  security, 

Backup  to  Carswell, 

NORAD/ADC, 

Over  toe  horizon  backscatter  radar,  and 
Tactical  frequency  management. 


Advanced  models  key  requirements  (listed  sequentially): 


Tropical  prediction  spherical  harmonics; 

Primitive  equation  window  model; 

Total  electron  content  model; 

Ionospheric  ray  tracing  model; 

Macroscale  and  high  resolution  cloud  prognoses; 

Global  analysis; 

Some  high  resolution  data  into  3DNEPH  programs; 

Advanced  global  atmospheric  prediction  model; 

Cloud  free  line  of  sight  probability  matrices; 

Statistical  polar  ionospheric  propagation  model;  and 
Primitive  equation  window  model  for  high  resolution,  short-range 
forecasts  at  low  altitudes. 


d.  Input  data  key  requirements: 


GOES, 

SWI  data,  and 
TIROS-N. 
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With  the  assistance  of  the  Air  Force  we  identified  requirements  which  were 
not;  to  be  considered  for  the  architectural  study.  The  following  list  represents 
a summary: 

Microwave  refraction  profiles  for  remote  piloted  vehicle  systems. 

Lightning  prediction  associated  with  remote  piloted  vehicle  systems. 

Optical  turbulence  prediction  for  space  optical  imaging  systems  and  high 
energy  laser  systems, 

Threat  assessment  for  SATRAN  and  SAC, 

A general  class  of  optimization  models  associated  with  WWMCCS  for  which 
nature  and  usage  were  not  specifically  identified. 

The  WWMCCS  survivability  requirement  (pertaining  to  more  than  the  scope 
of  the  architectural  study), 

Seeability  and  slant  range  visibility  for  tactical  systems  including  AWACS, 
and  Graphic  support  capability  for  AWN  beyond  that  specified  for  WWMCCS. 

In  addition,  certain  assumptions  were  agreed  to  concerning  some  of  the  stated 
requirements : 

Formats  of  messages  for  support  of  the  National  Meteorological  Center  were 
assumed  to  be  identical  to  current  GWC  formats. 

The  query  response  and  graphics  capability  for  modernized  base  weather 
station  are  assumed  equivalent  to  that  provided  for  WWMCCS  support, 

AFGWC  will  not  be  a major  node  of  the  AFOS  system. 

No  automated  communications  interface  is  assumed  for  field  Army  support 
and  the  capability  will  not  exist  to  provide  mesoscale  products  to 
remote  areas, 

In  the  Carswell  backup  the  NOTAM  pilot  aid  system  will  not  be  driven 
directly  by  AFGWC, 
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The  assumption  is  made  that  OTHB  data  can  be  as  much  as  2-3  hours  old. 


High  frequency  propagation  forecasts  will  be  limited  to  no  more  than 
1 hour  per  day  computer  time  on  a single  computer,  and 


No  support  will  be  provided  to  the  Global  Positioning  system. 


2.2  DATA  SYSTEM  CHARACTERISTICS 


2.2.1  Data  Storage 

The  results  of  the  characteristics  analysis  yielded  the  following  memory 
requirements  (given  in  number  of  characters): 


Conventional  57  x 10®  (models  - 12  x 10®,  other  - 45  x 10®) 


Array  5 x 10 


Disk  7816  x 10®  (fixed  head  - 26  x 10®,  other  - 7790  x 10®) 


Mass  35,000  x 10c 


A key  memory  consideration  was  the  ability  to  stage  data  from  a lower  rate 
access  device  to  a higher  rate  access  device  where  applicable.  Satellite  data 
presents  the  principal  storage  requirement  with  analysis  and  forecast  data 
being  second.  The  primary  storage  growth  occurs  in  1980.  Other  conclusions 
were  that  data  base  management  and  the  ability  to  monitor  data  base  usage  are 
extremely  important. 


2.2.2  Data  Transfer  and  Routing 

The  overwhelming  data  storage  and  computation  requirements  were  paramount 
considerations  in  data  transfer  and  routing.  In  addition,  the  response  to 
query  two  minute  time  requirement  dictated  a very  rapid  response  capability. 
Together  these  could  have  forced  the  cost  to  be  prohibitive.  The  only 
solution  was  to  provide  for  computer  intercommunication  and  instantaneous 
computer  access  to  the  bulk  of  the  data  base  (or  so  rapid  as  to  preclude  manual 
switching). 
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Such  a system  required  very  rapid  switching  and  initialization  of  data  system 
connections  as  well  as  protection  against  unauthorized  connections  through 
some  secure  authentication  scheme.  The  principle  of  load  leveling  of  tasks 
across  resources  suggested  a control  system  which  had  total  knowledge  of 
tasks,  priorities  and  resources  with  the  ability  to  activate  jobs  under  the 
constraints  of  security. 

The  security  requirements  on  the  system  dictated  the  need  to  pass  data  from  one 
device  to  another  and  to  protect  the  security  level  of  information  without 
compromise.  Thus,  the  capability  was  required  for  automated  upgrading  of 
classified  data,  and  manual  downgrading  and  certification  of  data  in  an 
efficient  manner. 

Economy  forced  the  consolidation  of  certain  functions  to  minimize  component 
costs  and  to  eliminate  personnel  in  such  areas  as  computer  operations,  communi- 
cations, and  data  input/output  support. 

It  was  obvious  that  very  strict  protocol  would  be  necessary  in  the  type  of 
environment  we  were  evolving  toward.  The  need  for  a central  data  base 
processor  was  obvious  and  that  presented  a significant  transfer  problem. 
Satellite  data  quantities  had  always  posed  a difficult  problem  and  the  decision 
to  process  high  resolution  (fine)  DMSP  data  and  to  additionally  process  TIROS-N 
and  GOES  data  presented  an  additional  challenge.  The  computer  flight  plan 
requirement  of  3000  per  day  or  250  per  hour  presented  a significant  transfer 
and  response  problem  as  did  the  digital  radar  which  requires  ingestion  at  a 
transfer  rate  of  2 x 1015  bits  per  second  for  four  seconds  every  fifteen 
minutes  under  severe  weather  conditions. 

2.2.3  Processors  and  Software 

The  processor  problem  is  a multivariate.  Considerations  encompassed:  1)  very 

high  computational  throughput  for  difficult  numerical  problems,  2)  simultaneous 


availability  of  computation  resources  because  of  conflicting  needs  within  the 
system  where  conflicts  arose  due  to  time  considerations  as  well  as  security 
considerations,  3)  the  dedication  of  computation  resources  to  specific  tasks 
traded  against  the  highly  complicated  flexibility  of  resources  to  perform 
multiple  functions,  and  4)  the  natural  redundancy  required  to  meet  the  high 
reliability  goal  of  certain  requirements  traded  against  the  obvious  disadvantages 
of  homogeneity.  When  the  average  CPU  usage  over  a twelve  hour  time  period  was 
plotted,  the  peak  loading  would  require  twelve  UNIVAC  1108  CPUs  operating  at 
100%  efficiency.  The  requirement  grows  from  approximately  five  in  1977  to 
eight  in  1978  and  1979  with  ten  in  1980  and  twelve  in  1981  and  1982.  About 
75%  of  the  computation  requirements  are  mathematical.  An  evaluation  of  current 
CPU  efficiency  showed  that  approximately  39%  was  wait  time  with  much  less  than 
half  of  the  input/output  transfer  time  overlapped  with  computation. 


The  primary  CPU  users  were  predicted  to  be  the  advanced  prediction  model, 
sprint,  satellite  data  Ingestion,  zoom  windows,  cloud  free  1 ine-of-sight,  and 
Minuteman.  Of  these  high  usage  requirements  (assuming  processing  capability 
of  10  million  instructions  per  second),  five  requirements  could  be  in  conflict. 


Separating  the  high  throughput  and  the  normal  computation  load  requirement 
from  one  another,  it  was  determined  that  five  10  MIPS  computers  (six  or  more, 
with  reliability  taken  into  account)  could  satisfy  the  primary  computation 
users,  with  the  rest  satisfied  by  a single  9 MIPS  computer  (plus  a factor  for 
reliability).  All  of  these  computations  were  based  on  100%  efficiency. 


Thus,  the  requirements  could  be  satisfied  by  very  fast  processors  (the  TI  ASC, 
CDC  Star,  or  one  of  the  many  Array  processors)  or  several  medium  speed  pro- 
cessors to  handle  the  same  problem,  along  with  many  function  dedicated  mini- 
computers for  such  things  as  communication  and  console  support. 


In  considering  software,  new  areas  of  concentration  become  evident.  AF&WC  would 
be  developing  software  for  tne  very  large  models,  as  well  as  network  control  and 
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data  base  management.  Other  new  areas  of  software  support  are  communications 
management,  generalized  work  center  interface,  programmer  interface,  performance 
monitoring,  and  diagnostic  software  for  both  hardware  and  software.  There  is 
a potential  for  multi-tasking  software  and  many  advantages  to  be  gained  by 
strict  protocol  standards. 


1 

1 

t 


2.2.4  Terminal  Interface 


\ 


Terminal  interface  has  the  problem  of  accommodating  many  data  lines  interfacing 
with  the  AFGWC  system.  The  desire  has  been  that  all  data  links  be  automated 
(direct  computer  interface).  This  resulted  in  a cumbersome  mixed  mode  security 
problem  because  all  normal  access  circuits  interfaced  with  one  computer. 

Normal  access  circuits  provide  classified  interfaces  with  the  AUTODIN  II  system, 
the  AUTODIN  system,  the  SAC  and  NSA  direct  links.  Unclassified  data  links 
include  20  ASR/KSR  teletype  circuits,  MAC  Det.  14,  AWN,  Navy,  NOAA,  DSP, 
digital  radar,  lines  for  back  up  of  ETAC  and  Carswell  and  the  satellite 
imagery  dissemination  system.  To  support  the  facsimile  requirenjpnts,  there 
are  analog  interfaces  with  STRATFAX,  PACFAX,  RAFAX,  and  the  National  Weather 
Service.  Future  facsimile  requirements  include  interface  with  AFOS,  a 
back  up  capability  to  the  National  Weather  Service,  and  a digital  interface 
with  the  1979  Weather  Graphics  System.  Thus,  a consolidated  communications 
terminal  was  needed  to  interface  with  these  lines.  In  addition,  three  data 
interfaces  would  exist  in  the  special  access  area. 
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Data  transmission  rates  are  4800  baud  or  under  with  four  exceptions:  digital 

radar,  AUTODIN  II,  Fleet  Numerical  Weather  Central,  and  satellite  data. 
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Digital  radar  will  have  a data  rate  of  2 x 10.  bits  per  second  in  four  second 
bursts  which  can  occur  as  often  as  every  15  minutes.  AUTODIN  II  and  Fleet 
Numerical  Weather  Central  information  will  be  transferred  at  rates  up  to  50 
kilobaud.  Input  rates  for  satellite  data  are  up  to  2.6624  megabits  per  second. 
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The  ingestion  of  satellite  data  requires  the  following: 

a.  Total  processing  of  all  DMSP  and  TIROS-N  smooth  data, 

b.  3%  processing  of  DMSP  fine  data  in  1978  and  10%  in  1980,  and 

c.  The  processing  of  five  (20°  x 20°)  windows  of  GOES  data  in  1977. 


The  daily  volume  associated  with  the  satellites  is: 

a.  DMSP  (two  vehicles)  - smoothed  data,  266  x 106  words  per  day;  fine 
data,  23.94  x 106  words  per  day  (1978);  fine  data,  79.8  x 10  words 

per  day  (1980); 


TIROS-N  - smoothed  data,  266  x 10  words  per  day;  fine  data,  not 
required;  and 


GOES-42  readouts,  2142  x 106  words  per  day. 


2.2.5  Automated  Work  Centers 


The  need  for  automated  work  centers  arose  because  of  the  potential  for  reducing 
manpower  as  well  as  providing  for  new  support  requirements.  This  resulted  in 
specification  of  the  following  console  areas. 

a.  Mission  support  consoles:  network  control  (1),  computer  operations 

(2),  security  downgrade/remote  job  entry  (2),  communications  (2), 
satellite  imagery  dissemination  (1),  and  maintenance  (probably  1 
per  main  processor). 


Mission  operations  consoles:  TAF/Metwatch  (13),  military  weather 

advisory  (1),  synoptic  (5),  forecaster  special  access  (3),  SESS 
normal  access  (1),  SESS  special  access  (1),  quality  assurance  (1), 
programmer  special  access  (4),  programmer  normal  access  (22), 
studies  and  analysis  (4),  and  special  operations  forecasting  (1). 
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2.2.6  Input  and  Display 

For  the  man-machine  interface,  the  requirements  were  diverse  and  had  to  be 
satisfied  in  many  different  ways.  This  dictated  the  following  basic 
characteristics: 

a.  Rapid  response  visual:  standard  alphanumeric  CRT/control,  CRT, 

high  resolution  CRT  (on  the  order  of  six  bits  per  element  and  1000 
by  1000  pixels),  CRT  hardcopy  device,  and  high  speed  printers  with 
special  character  capability.  The  printers  must  support  ten 
classification  levels  and  print  spooled  data  at  a peak  output  of 
25,000  lines  per  minute. 

b.  Miscellaneous  status:  configuration  display  for  network  control, 

security  display,  switch  and  master  switching  capability,  card 
reader/punches,  alphanumeric  fixed  function  keyboard,  light  pen, 
magnetic  cursor  capability,  and  digitizing  table  capability. 

2.2.7  Personnel 

SDC  determined  that  the  expected  manning  requirements  for  the  six  major  branches 
of  the  AFGWC  Production  Division  would  be  659  slots  by  1982.  This  is  predicated 
on  a baseline  of  605  slots  which  were  assigned  in  early  1975  plus  an  additional 
54  slots  that  will  be  necessary  to  support  increased  1977-82  requirements. 

However,  it  is  assumed  that  17  slots  can  be  saved  by  automation,  resulting  in  a 
net  of  642  personnel  slots  in  these  six  organizations.  Of  these  642  slots, 

355  men  are  expected  to  be  directly  involved  in  the  use  of  automated  work  centers. 
Thus,  over  50%  of  the  operational  personnel  can  be  expected  to  be  using 
automated  means  for  task  performance. 

The  savings  of  17  slots  through  automation  are  based  on  the  following  analyses 
of  operations  in  three  branches  in  the  AFGWC  Production  Division.  One  area 
where  savings  can  occur  is  in  the  development  and  maintenance  of  computer 
programs  and  models.  A recent  one-year  study  that  involved  automation  of  the 
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programming  function  with  interactive  CRTs  and  automated  peripherals.  The 
result  was  that  programs  were  developed  four  to  six  times  faster. 

In  comparing  the  models  developed  at  AFGWC  with  the  programs  developed  during 
this  one-year  study,  the  AFGWC  models  are  much  more  complex  and  scientifically 
oriented.  Also,  some  uncertainties  that  currently  exist  regarding  the  final 
approved  AFGWC  architecture  require  a conservative  estimate  of  the  manpower 
savings  due  to  automation.  The  SDC  estimate  for  a more  appropriate  figure  for 
the  savings  in  the  function  of  developing  new  programs  is  approximately  20/. 
Using  this  20%  as  a guideline,  the  following  figures  result: 

WPA  (approximately  20  programmers) 

70%  of  the  programmers  involved  in  new  program  development. 

70%  X 20  = 14 

X 20%  savings  through  automation 
3 

WPP  (approximately  100  programmers) 

30%  of  the  programmers  involved  in  new  program  development 
30  X 100  = 30 

X 20%  savings  through  automation 
6 

For  program/model  maintenance,  a 3%  savings  was  considered  appropriate.  This 
resulted  in  the  following: 


WPP 

70%  of  the  programmers  involved  in  maintenance 
70%  X 100  = 70 

X 3%  savings  through  automation 
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MPF 

With  automation  of  many  of  the  WPF  functions,  there  will  be  no  requirement 
for  some  of  the  manual  operations  being  currently  performed.  Thus,  it 
should  be  possible  to  reduce  the  number  of  observers  supporting  the  fore- 
casters. At  this  point,  SDC  estimates  that  approximately  six  observers 
would  no  longer  be  required. 

The  total  approximate  savings  in  current  manpower  through  automation  is  therefore 

WPA  3 

WPD  8 

WPF  _6 

Total  17 
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2.2.8  Management 


External  direct  control  of  the  data  system  (beyond  that  accorded  in  the  query 
response  capability)  would  cause  many  problems  and  is  therefore  prohibited. 
The  exception  to  this  rule  is  the  existing  direct  interface  with  the  SAC 
Control  Center.  Internally,  the  operational  responsibility  for  the  data 
system  needed  to  be  centralized.  This  function  developed  into  a single  net- 
work control  position. 


Operationally,  the  single  most  important  set  of  design  characteristics  arose 
from  security  considerations.  The  need  exists  for  physical  isolation  of  the 
entire  data  system  to  prevent  any  external  intervention.  Physical  protection 
is  also  needed  within  the  data  system  for  separation  of  special  access  and 
normal  access  operations.  Between  system  components,  there  must  be  isolation 
of  distinct  levels  of  security.  This  can  be  accomplished  either  physically 
or  electronically  (through  authentication  encoding).  With  this  in  mind,  the 
system  is  designed  to  minimize  the  amount  of  software  needed  for  proper 
security  control,  but  maximize  the  amount  of  software  for  checking  and 
enforcing  it.  The  overall  goal  was  to  hold  data  and  resources  to  the  lowest 
security  level  possible. 


Automatic  upgrading  of  information  is  needed  from  a lower  security  level 
component  to  a higher  level  component  with  no  risk  of  security  compromise  in 
the  other  direction.  Conversely,  unclassified  information  messages  from  high 
level  components  need  to  be  passed  to  low  level  components  in  order  to 
accomplish  resource  allocation  and  job  assignment.  Mixed  mode  security  exists 
in  only  two  areas:  one  at  human  interfaces  (in  which  case  the  security 

responsibility  is  assigned  to  the  operator),  and  the  other  in  the  interface 
with  the  external  mixed  mode  communications  systems.  In  addition,  rapid  and 
accurate  certification  or  downgrading  of  small  amounts  of  data  is  needed. 

This  will  be  accomplished  at  a security  monitor  console. 
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Certain  resources  such  as  main  processors,  array  processors,  and  selected  con- 
soles must  be  able  to  operate  at  different  security  levels  at  different  times 
due  to  varying  product  requirements.  This  implies  a rapid  cleaning/change  of 
level  capability  as  well  as  increased  redundancy. 

To  minimize  system  cost,  it  is  advantageous  to  provide  a means  for  shared 
redundancy  between  the  normal  access  computer  area  and  the  special  access  area 
by  means  of  a "variable  perimeter"  set  of  main  processors.  These  processors 
can  be  switched  to  either  area  at  any  level  within  that  area. 

In  the  area  of  quality  assurance,  it  was  apparent  that  the  quality  assurance 
task  should  be  further  automated  with  a centralized  control  position. 

The  two  principal  logistics  problems  were  phaseover  and  the  spare  parts 
philosophy.  These  can  only  be  addressed  generally  until  a specific  archi- 
tecture has  been  approved.  Nevertheless,  the  phaseover  was  dictated  by  the 
time  phasing  of  the  key  driving  requirements  for  individual  components  within 
the  system. 

In  readiness  planning,  the  system  must  accommodate  readiness  exercises  in 
preparation  for  support  of  a new  activity  and  also  in  preparation  for  support 
of  peak  load  and  abnormal  conditions.  A system  simulation  capability  must 
allow  operating  the  system  independent  of  the  outside  world  with  simulated 
data  and  the  ability  to  simulate  operational  loading  conditions.  A capability 
must  also  exist  for  long-term  scheduling. 

The  requirement  exists  not  only  to  support  development  during  the  phaseover 
of  any  new  data  system  but  also  to  support  augmentation  on  a continual  basis 
both  in  hardware  and  software. 
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The  data  system  must  accommodate  preventive  maintenance  with  a full  failure 
response  capability  without  jeopardizing  the  overall  timing  and  reliability 
requirements.  It  is  also  important  that  a graceful  degradation  feature  will 
exist  in  the  system  whereby  lower  priority  tasks  are  sacrificed  before  higher 
priority  tasks. 


2.2.9  Facilities 


An  uninterruptable  power  system  (similar  to  the  existing  system)  must  exist  to 
accommodate  the  reliability  requirements.  The  environment  for  both  personnel 
and  paper  products  must  be  considered  as  well  as  the  support  of  the  basic 
component  operations.  Personnel  work  areas  must  be  in  accordance  with  favor- 
able human  working  conditions.  There  must  be  adequate  storage  and  support. 

It  is  desirable  to  minimize  the  amount  of  reconstruction  for  the  data  system 
because  of  time  delay  and  additional  cost.  There  must  be  adequate  storage 
area  for  support  of  the  required  data  system.  The  data  system  must  be  designed 
for  the  appropriate  technical  level  of  assigned  personnel.  Training  at  a 
reasonable  level  must  also  be  a design  consideration. 


2.3  RESULTS  OF  VENDOR  SEARCH 

Realizing  that  we  could  not  explore  the  total  industry  in  the  time  available, 
we  limited  ourselves  by  concentrating  on  large  computers  and  memory  systems. 

We  dealt  with  vendors  who  previously  had  been  involved  in  the  meteorological 
problem  or  had  shown  a recent  interest  in  such  involvement,  and  we  concentrated 
on  large  computer  manufacturers.  Our  final  basis  for  concentration  had  to  do 
with  responses  to  initial  vendor  contacts  requesting  a nondisclosure  agreement 
for  advanced  information  during  the  period  of  time  of  the  architectural  study. 
Initial  contacts  with  specialty  computer  houses  revealed  consulting  services 
to  be  too  expensive  so  we  relied  on  other  studies  (e.g.,  SADPR  85)  to  draw 
our  conclusions. 
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From  our  vendor  search  we  concluded  that  there  will  be  no  computer  generation 
announced  until  approximately  1980.  A new  generation  would  not  be  available 
for  AFGWC  until  approximately  1982;  therefore,  we  did  not  consider  that 
possibility  for  our  study. 

However,  we  found  that  higher  order  languages  are  being  microcoded.  There 
were  faster  and  larger  main  storages  associated  with  computer  systems,  which 
met  one  of  our  primary  objectives.  Certain  operating  system  functions  are 
also  being  microcoded  to  reduce  system  overhead. 

In  the  low  to  medium  size  CPUs,  performance  gains  were  approximately  a factor 
of  two,  and  for  large  CPUs  there  appeared  to  be  no  appreciable  gain.  There- 
fore, we  looked  to  the  current  computers  as  solutions  to  our  problems.  Medium 
processors  (which  we  referred  to  in  our  study  as  the  main  processor)  ranged 
from  zero  to  twenty  RP.  (An  RP  is  a Relative  Performance  Unit  which  is  our 
assessment  of  the  computing  power  of  an  1108  processor;  however,  it  must  be 
realized  that  there  are  many  factors  which  are  taken  into  account  when  doing 
a performance  valuation  of  a computer).  Looking  at  the  Amdahl,  the  IBM  370 
series,  the  CDC  Cyber  and  the  Uni  vac  1100  series,  there  seems  to  be  groupings 
centered  around  3.5  RPs  and  12  RPs.  We  considered  these  groupings  in  our 
Tradeoff  Analysis  and  processor  selection. 


Fast  computers  fall  into  two  groups:  large,  expensive,  general  purpose 

vector/pipeline  processors  and  the  special  purpose  less  expensive  array 
processors.  The  first  group  includes  the  TI  ASC  and  CDC  STAR.  The  second 
group  includes  parallel,  associative,  and  vector/pipeline  processors.  These 
were  available  from  most  major  computer  manufacturers  and  many  small  companies. 
Although  they  are  very  fast  and  inexpensive  it  is  difficult  to  determine 
efficiency,  the  ease  of  programming,  the  distribution  of  workload  with  a 
host  computer  which  must  support  them  and  the  difficulty  to  formulate  problems 
to  properly  adapt  their  special  characteristics  (usually  developed  for  another 
appl ication) . 
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The  disk  technology  forecast  can  best  be  portrayed  by  what  was  written  in  the 
SADPR-85  study.  Disks  will  be  doubled  in  density  by  1982  to  68  million  words 
per  pack  for  approximately  a 10%  cost  Increase  over  current  8433  types  of 
disk.  There  probably  will  be  no  noticeable  improvement  in  the  access  time  due 
to  head  motion.  (There  may  be  double  the  number  of  tracks  on  a disk  and  double 
the  rotation  rate,  which  results  in  no  noticeable  decrease  in  track  access  time 
tut  a cUwbltrvg  of  disk  transfer  rate,)  Vendors  may  delay  release  of  the  new 
disks  based  upon  amortization  of  current  units  in  the  field.  In  the  early 
1 980 ' s , bubble  or  charge  coupled  device  memories  will  be  available,  but  based 
on  our  requirements  and  the  high  risk  associated  with  delivery  of  these  devices, 
we  decided  not  to  consider  them  in  our  current  study. 


We  looked  at  vendor  data  management  software  systems  only  to  find  that  their 
orientation  is  primarily  commercial  and  they  do  not  seem  to  fit  the  AFGWC 
requirements  without  significant  changing.  Most  vendors,  are  reluctant  to 
change  their  standard  software  packages. 


We  discussed  security  with  many  vendors  only  to  find  that  there  is  little 
application  for  existing  privacy  capabilities  in  a DOD  security  environment, 
and  that  the  capabilities  of  isolated  executive  and  data  management  systems 
will  not  be  a reality  for  some  time.  Even  then,  there  will  be  a tough  battle 
passing  strict  DOD  security  requirements. 


Looking  at  tape  technology,  it  is  best  described  by  the  SADPR  85  study  write-up. 
"There  will  be  no  increase  in  linear  density  with  a maximum  of  10,000  bits  per 
inch.  There  is  a possibility  of  doubling  the  number  of  tracks  on  a tape  from 
eight  to  sixteen  in  parallel  and  tape  speed  may  double  using  a smaller  inter- 
block gap,  higher  transfer  rate  (though  probably  resulting  in  a higher  error 
rate)."  Large  vendors  are  moving  away  from  conventional  tapes  toward  mass 
storage  facility  systems  which  are  automatic  and  provide  better  efficiency 
with  smaller  tapes. 
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2.4  KEY  TRADEOFF  AND  ANALYSIS  STUDIES 


Our  tradeoff  studies  yielded  many  important  conclusions.  The  major  ones  are 
presented  below. 

2.4.1  Data  Storage 

Mass  memories  should  be  used  for  unclassified  archival  storage. 

Fixed  head  disks  should  be  used  for  staging  and  for  rapid  cleaned  applications. 
Staging  should  be  incorporated  throughout  the  system. 

Redundant  disk  and  drum  should  be  used  for  backup. 

Multiple  processors  may  access  single  disks  theoretically;  however,  in  practice, 
this  will  be  minimized. 

Communication  buffering  should  be  on  system  disks  instead  of  independent  disks. 

A single  universal  data  base  should  be  used  with  classified  overlays  based  on 
security  requirements. 

There  is  no  need  for  data  compression  of  satellite  data  merely  for  the  purpose 
of  saving  storage. 

The  concept  of  a WWMCCS  data  base  should  be  generalized  to  include  all  query 
type  requirements. 
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Data  base  structure  should  be  transparent  to  application  of  programs. 

The  meteorological  data  base  structure  should  be  redefined  for  higher 
efficiency. 

A special  data  base  management  system  should  be  developed  for  AFGWC  rather 
than  the  procurement  of  a vendor  produced  system. 

The  capability  to  collect  data  base  usage  statistics  should  exist  to  the 
extent  practical. 

A data  oriented  language  should  be  considered  to  augment  FORTRAN  at  AFGWC. 


2.4.2  Data  Transfer  and  Routing 


Parallel  upgrade,  communication  link  and  control -only  data  link  should  provide 
primary  intercommunication  between  main  processors  and  disk  devices  within  AFGWC. 

A delimiting  device  should  be  used  to  filter  control  information  in  the 
control -only  data  link. 

An  encryption  type  of  device  should  be  used  for  authentication  purposes  to 
establish  appropriate  links  between  processors  and  data  bases  in  the  multi- 
security environment  of  AFGWC. 

Master  data  base  processor  should  transfer  both  to  disk  and  directly  to 
processors. 

2.4.3  Computation  and  Software 

Faster  machines  begin  to  be  limited  by  their  transfer  rates. 

AFGWC  models  will  require  the  equivalent  computing  power  of  ten  Uni  vac  1108 
computers  operating  at  100%  efficiency. 

9rj%  of  computation  is  unclassified. 

Pipeline  type  of  array  processors  show  more  application  at  AFGWC  than  parallel 
or  associative  processors  for  models. 

Dedicating  processors  to  special  functions  should  be  avoided. 

Large  jobs  should  be  split  into  smaller  components  to  meet  time  requirements 
and  save  computer  power. 

Multiprocessors  are  advantageous  it  they  have  the  capability  to  become  part 
of  distinct  data  paths  at  different  security  levels. 

Centralized  data  base  management  should  be  dedicated  to  specific  processors. 

Each  processor  system  should  have  its  own  dedicated  array  processor. 

There  should  be  as  many  communications  processors  as  there  are  security  levels 
of  data  lines. 


2.4.4  Terminal  Interface 

The  Air  Force  Communications  Service  should  be  responsible  for  the  communica- 
tions systems  and  the  decoder  router  while  AFGWC  should  be  responsible  for  the 
disk  interface  and  the  communications  console. 

Message  logging  should  be  employed  in  the  communications  system. 

The  system  must  accommodate  data  rates  of  4800  baud  with  the  following  excep- 
tions: AUTODIN  II  and  satellite  data  to  Fleet  Numerical  Weather  Central  are 

50  kilobaud  and  digital  radar  is  200  kilobaud. 

The  capability  should  exist  to  filter  satellite  data  using  predefined  data 
base  values  and/or  user  time  criteria. 

The  satellite  imagery  dissemination  system  should  only  be  able  to  interface 
with  gridded  imagery. 

Satellite  data  gridding  and  mapping  should  be  accomplished  by  the  main 
processor  by  increasing  the  central  system  processor  storage  to  implement 
significant  input/output  overlays. 

Forecaster  consoles  which  produce  facsimile  products  should  be  connected  to 
the  Interdata  50s  which  will  interface  with  all  of  the  facsimile  circuits. 

2.4.5  Consoles/Data  Input  Display 

Automatic  work  centers  should  use  a "mail  drop"  disk  communication  technique. 

Operations  consoles  should  be  placed  in  centralized  positions  in  both  special 
access  and  normal  access  perimeters. 

AFGWC  should  develop  the  capability  for  interactive  satellite  imagery  com- 
pression rejection  for  display. 

Remote  terminals  are  recommended  for  terminal  interface  rather  than  remote 
run  card  entry  readers. 
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2.4.6  Personnel 

AFGWC  requires  more  personnel  to  perform  the  programming  tasks. 

There  should  be  a mix  of  commercial  software,  contract  programming  software 


and  Air  Force  programming  software. 


2.4.7  Management 

The  1977-1982  requirements  can  be  accommodated  with  modest  changes  to  the 
AFGWC  organisational  structure. 

Greater  emphasis  should  be  placed  on  acquisition/integration  activities  in  the 
operations  staff. 

Operations  management  is  changed  as  a result  of  network  control  to  the  extent 
of:  a)  consolidating  the  operational  control  function,  b)  putting  preplanning 
parameterization  in  place  of  real  time  planning,  and  c)  providing  direct  single 
point  control  when  unforeseen  anomalies  arise. 

Multi-tasking  should  be  used  to  the  maximum  extent  allowed  by  individual  func- 
tions and  their  time  lines. 

Functions  should  not  be  dedicated  except  in  the  area  of  network  control  and 
master  data  base  management. 

A fairly  complex  run  characteristic  feedback  capability  is  required. 

A multiprocessor  should  be  scheduled  as  a unit. 

Software  should  be  modularized  with  the  capability  to  perform  computation  at 
the  lowest  security  level. 

There  is  no  advantage  in  pursuing  a design  to  accommodate  a secure  operating 
system. 

No  simulation  models  should  be  incorporated  other  than  the  scheduling  prediction 
and  exercise  support  capability. 

Present  software  should  be  brought  under  structured  programming. 
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Programmer  productivity  can  be  increased  by  better  selection  of  personnel 
assignments. 

Chief  programmer  teams,  top  down  design,  and  structured  programming  should  be 
used. 

I 

Interactive  programming  should  be  the  primary  technique  of  programmer  inter- 
face. 

AFGWC  facilities  are  adequate  to  house  the  proposed  hardware. 

2.5  ARCHITECTURE  AND  HARDWARE  CONFIGURATION 

This  section  deals  with  the  hardware  configuration  and  describes  at  a conceptual 
level  those  resources  that  are  available  in  the  enhanced  architecture.  Figure  1 
shows  an  architecture  overview. 

The  architecture  consists  of  a network  of  main  processor  systems  under  the 
central  authority  of  network  control.  The  security  levels  and  functions 
performed  by  the  main  processor  systems  are  not  fixed  but  rather  can  be  varied 
to  meet  demands  on  system  resources. 


The  processors  are  linked  to  a set  of  data  bases,  which  are  fixed  at  security 
levels  and  are  dedicated  to  functions.  These  data  bases  serve  as  the  primary 
interface  between  the  major  system  resource,  i.e.,  the  main  processor  systems, 
and  the  functional  interfaces  with  data  system  users. 

Four  major  subsystems  are  defined  exterior  to  the  nucleus  of  main  processor 
systems.  These  subsystems  are  communications,  satellite  data  ingestion,  mis- 
sion support  automated  work  centers  and  mission  operations  automated  work 
centers.  The  data  bases  provide  a buffer  between  externally  imposed  loads 
and  system  resources,  allowing  a central  authority  to  control  system  resource 
allocation.  This  optimizes  system  responsiveness  under  a wide  variety  of 
scenarios.  The  communications  subsystems  are  responsible  for  the  handling  of 
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Fiaure  1.  ARCHITECTURE  OVERVIEW 


normal  communications  traffic  over  lines  such  as  AUTODIN  and  AWN.  There  are 
two  such  subsystems,  one  located  in  the  normal  access  and  one  located  in  the 
special  access  perimeter.  A satellite  data  ingestion  subsystem  is  responsible 
for  the  capture  of  satellite  data  from  meteorological  vehicles  into  the  data 
base.  Mission  support  automated  work  centers  handle  those  activities  that  do 
not  perform  actual  mission-oriented  work  but  are  necessary  to  the  success  of 
the  data  system,  such  as  network  control  and  maintenance.  Mission  operations 
automated  work  centers  modify/interact  with  the  data  bases  to  prepare  user 
products  (examples  are  TAF/METWATCH  and  SESS).  The  mission  support  and  mission 
operations  work  centers  are  clustered  around  data  entry  and  display  devices 
located  in  consoles. 


Figure  2 shows  a more  detailed  description  of  the  AFGWC  enhanced  architecture 
at  a block  diagram  level  without  interconnections.  This  diagram  shows  the 
data  system  when  it  will  have  full  capabilities  (e.g.,  sometime  prior  to  1982). 
A line  in  the  center  running  from  top  to  bottom  divides  the  system  into  special 
and  normal  access  areas.  The  variable  perimeter  located  in  the  approximate 
center  of  the  diagram  can  be  switched  physically  and  electronically  from 
special  to  normal  access,  and  it  acts  as  a backup  for  both  sides.  There  are 
five  main  processor  systems,  one  located  in  special  access,  one  in  the  variable 
perimeter,  and  three  in  the  normal  access  area. 

There  are  four  data  base  subsystems,  one  for  special  access  and  three  in  the 
normal  access  area.  The  three  in  the  normal  access  area  are  divided  into  the 
classified  data  (Top  Secret  SIOP,  Top  Secret,  Secret  and  Confidential),  raw 
satellite  data,  and  the  unclassified  central  meteorological  data  base. 

At  the  top  of  the  diagram  are  network  control  and  the  two  operations  centers, 
one  for  special  access  and  one  for  normal  access.  Network  control  has 
responsibility  for  the  global  scheduling  and  health  of  the  data  system,  whereas 
the  operations  centers  concentrate  on  each  individual  main  processor  system. 
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Figure  2.  AFGWC  ENHANCED  ARCHITECTURE 


Programmer  support  areas  are  located  in  both  special  and  normal  access.  These 
consist  of  alphanumeric  CRTs  attached  to  support  processors  (which  may  be 
either  minicomputers  or  control  units)  and  are  linked  directly  to  processor 
systems.  They  are  not  interfaced  through  the  data  base  and  are  the  only 
exception  to  this  rule.  This  route  was  chosen  to  preserve  vendor-supplied 
software  development  packages. 

Forecaster  and  communications  support  areas  located  in  the  lower  portion  of 
the  diagram  are  linked  to  the  main  processor  system  through  the  data  base. 
Within  the  normal  access  area,  satellite  ingestion  processors  interface 
with  satellite-relay  communications.  Satellite  and  forecaster  support 
processors  are  pooled  to  allow  common  backup  units,  which  increase 
reliability  at  minimal  cost. 

The  data  system  has  a hierarchy  of  processing  power  to  be  applied  against 
any  given  job.  At  the  top  level  in  terms  of  millions  of  instructions  per 
second  (MIPS)  are  the  array  processors,  which  are  attached  locally  to  each 
main  processor  system.  Following  them  are  the  powerful  general  purpose 
processors  which  form  the  main  processor  systems.  Each  of  the  five  main  pro- 
cessors has  approximately  3.5  times  the  throughput  of  a Univac  1108,  currently 
used  at  the  Global  Weather  Central.  Within  each  functional  area  (such  as 
communications,  forecaster,  programmer,  or  operations)  are  support  processors 
which  supply  local  computing  capability  and  act  as  an  interface  between 
work  center  peripherals  and  the  computer  network. 

At  the  bottom  of  the  hierarchy  are  the  interface  processors  used  between 
individual  consoles  and  support  processors,  or  to  handle  complex  non-vendor- 
supported  interfaces.  These  interface  processors  consist  of  mini  or  micro 
processors  which  have  little  main  memory. 
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Although  most  system  communication  takes  place  through  the  data  base,  direct 
processor  linkages  are  provided  for  the  transfer  of  large  volumes  of  data 
between  main  processor  systems.  This  is  accomplished  via  a "wagon-wheel 
approach,  where  any  processor  sends  data  to  a central  point,  from  which  it  is 
routed  to  other  processors.  This  can  be  done  either  for  two  unclassified 
processors,  or  data  can  be  sent  from  a lower  to  a higher  classification  level. 
The  focal  point  for  this  activity  is  the  upgrade  processor,  shown  in  the 
special  access  perimeter  just  above  the  variable  perimeter.  On  the  diagram, 
beneath  this  upgrade  processor,  is  a control-only  link.  The  control-only 
path  has  a highly  limited  bandwidth  and  allows  only  certain  character  sets  to 
be  sent  between  processors.  This  enables  a processor  of  a higher  classification 
level  to  request  data  base  elements  or  interrupt  a lower  classification  level 
processor.  This  control-only  link  is  the  mechanism  whereby  the  network  control 
computer  schedules  the  remainder  of  the  data  system.  The  network  control  com- 
puter resides  in  special  access  because  it  must  have  knowledge  of  all  activity 
within  the  data  system  including  those  at  the  highest  classification  level. 


Figure  3,  the  AFGWC  system  architecture,  illustrated  in  the  enclosed  foldout, 
shows  an  expansion  of  the  block  diagram  of  Figure  2 with  interconnections  and 
each  block  developed  in  fuller  detail.  For  your  convenience  in  locating  items 
mentioned  in  the  text,  a coordinate  system  has  been  established  in  the  diagram. 
Along  the  left  hand  side  are  a set  of  numbers  from  1 to  12  and  along  the  bottom 
are  a set  of  letters  from  A through  Q.  When  a major  subsystem  is  mentioned,  a 
coordinate  location  will  be  given  next  to  it  in  parentheses.  In  the  upper  right 
hand  corner  of  the  diagram  (Q-l 2 ) is  located  an  abbreviations  table.  In  the 
lower  center  of  the  diagram  (H-5)  is  located  a symbol  table.  References  such  as 
(AXXX)  found  with  the  abbreviations,  symbols,  or  the  diagram  itself  refer  to  the 
architectural  domain.  A vertical  line  (G-l  through  G-12)  divides  the  normal 
from  the  special  access  perimeters.  The  variable  access  perimeter  (E-6)  con- 
tains only  a main  processor  system  and  the  variable  perimeter  switch,  which 
alters  status  from  normal  to  special  access  by  changing  the  peripheral  sets 
attached  to  the  main  processor  system.  The  variable  access  perimeter  contains 
only  rapidly  cleanable  devices  so  that  it  can  be  switched  quickly  from  one 
mode  to  another. 
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Arranged  in  a checkerboard  fashion  between  the  processor  systems  are  the  data 
bases.  Subsystems  that  deal  with  subsystem  interfaces  such  as  communications, 
operations,  or  programmers  are  located  around  the  central  nucleus  of  data 
bases  and  main  processor  systems.  In  the  sections  that  follow,  the  hardware 
configuration  is  examined  in  more  detail,  beginning  with  processor  subsystems. 

Main  processor  subsystems  consist  of  a hierarchy  of  processing  capability  and 
memory  speeds.  The  general  purpose  processing  capability  is  provided  through 
a dual  multiprocessor  system  in  which  two  CPUs  access  common  main  memory. 

The  general  purpose  computing  capability  is  augmented  by  a more  specialized 
array  processor  capability.  The  system  may  be  split  in  the  security  verifiable 
manner  to  run  as  separate  uniprocessors. 

The  main  memory  on  the  system  which  may  consist  of  both  main  and  extended 
memory  can  be  split  in  a nonsymmetric  fashion  between  the  two  uniprocessors. 
Attached  as  the  next  hierarchy  of  memory  are  fixed  head  disks  which  provide 
scratch  areas  for  the  execution  of  models  and  as  work  areas  for  the 
operating  systems. 

All  input/output  is  shown  as  redundant  and  symmetrical.  Each  individual 
connection  to  the  input/output  unit  of  the  multiprocessor  is  intended  to 
correspond  to  an  individual  channel,  although  the  number  of  channels  will 
depend  on  the  individual  vendor  architecture.  Fixed  head  disks  are  shown 
redundantly  on  separate  control  units  so  that  they  can  be  split  when  the 
multiprocessor  is  segmented. 

An  authentication  chip  memory  is  shown  for  each  half  of  the  multiprocessor. 

The  authentication  chip  memory  is  set  by  network  control  via  an  authentication 
key  link  and  determines  the  security  level  of  the  processor  by  establishing 
what  connections  are  accessible  to  it.  The  maintenance  console  is  provided 
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for  each  main  processor  system  and  is  intended  to  contain  all  necessary 
peripherals  for  stand  alone  maintenance  of  the  processor. 


Support  processors  provide  a minimum  computing  capability  for  short  term 
responses  to  individual  functions.  In  addition,  they  provide  an  interface 
between  the  automated  work  center  personnel  using  peripheral  devices  and  the 
major  processing  capability  of  the  system  via  a data  base. 


The  only  support  processor  which  is  directly  attached  to  a main  processor 
system,  rather  than  going  through  the  data  base,  is  the  programmer  support 
processor  (E-3,  M-3),  as  previously  mentioned.  Programmer  consoles  are 
provided  in  both  the  special  and  normal  access  perimeters.  In  the  special 
access  perimeter,  they  will  be  enclosed  in  the  vaulted  area.  In  the  normal 
3-ccrtS  pr-H meter,  the  consoles  will  reside  in  the  Individual  office  uf 
programmers  or  groups  of  programmers.  The  console  itself  consists  of 
an  alphanumeric  CRT  with  a keyboard. 


Processors  that  support  forecaster  functions  (F-3,  N-6)  have  been  pooled  with 
those  that  provide  for  the  ingestion  of  satellite  data.  They  have  the  similar 
characteristic  of  high  bandwidth  for  data  transfer  and  pooling  provides  a 
higher  degree  of  reliability  at  a lower  cost  than  would  be  possible 
otherwise. 


Forecaster  consoles  have  been  broken  out  according  to  function.  For  example, 
there  are  TAF/METWATCH  consoles,  SESS  consoles,  MWA  consoles  and  synoptician's 
consoles.  Satellite  imagery  dissemination  (SID)  is  accommodated  by  the 
satellite  ingestion  processor.  Support  processors  for  satellite  imagery 
dissemination  and  forecasters  have  a local  scratchpad  data  base  (E-2,  N-5)  for 
manipulation  of  displays  and  the  receipt  of  data  base  elements  from  the  central 
unclassified  meteorological  data  base.  Each  console  consists  of  a mixture 
of  devices  such  as  alphanumeric  CRTs,  high  resolution  black  and  white  CRTs, 
and  color  CRTs. 
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The  communications  subsystems  (B-2,  0-2)  consist  of  several  computers,  one  for 
each  security  level.  These  computers  are  designated  "line  handler/decoder  routers". 
They  have  the  responsibility  for  all  line-oriented  functions,  such  as  acknowl- 
edgements, retries  and  error  correction.  Because  secured  lines  may  contain  a 
mixture  of  security  level  messages,  each  line  handler/decoder  router  (LHDR)  must 
be  capable  of  downgrading  messages  to  a lower  security  level.  In  order  to 
confine  mixed  mode  security  to  the  smallest  possible  subset  of  the  data 
system,  each  line  handler/decoder  router  passes  these  lower  security  level  messages 
to  another  line  handler/decoder  router  at  the  appropriate  security  level.  This 
line  handler/decoder  router  simply  views  this  transaction  as  coming  from  an 
additional  communications  circuit  that  it  must  handle. 


All  line  handler/decoder  routers  are  interfaced  with  the  communications  console 
(D-3,  L-2)  which  has  responsibility  for  unscrambling  garbled  messages  and  passing 
them  to  the  appropriate  security  level.  Data  passed  through  the  communications 
console  is  buffered  on  a low  capacity  storage  device.  This  low  capacity  storage 
device  (LCSD)  can  then  be  physically  removed  and  transferred  to  a reading 
device  which  has  been  switched  into  the  appropriate  security  level.  This 
provides  physical  isolation  so  that  there  is  no  path  for  accidental  leakage 
of  data  from  one  security  level  to  another.  Redundant  line  handler/decoder 
routers  are  provided  for  complete  availability  of  the  communications  subsystems. 


Subsystems  provided  for  mission  support  are  network  control  (B-6),  the 
printer  subsystems  in  the  normal  ( I- 11 ) and  special  access  (C-ll)  areas, 
the  operations  centers  in  the  normal  (K-ll)  and  special  access  ( D- 1 1 ) areas, 
the  data  downgrade  for  normal  (L- 1 1 ) and  special  access  (F-ll),  and  the 
special  operations  console  (H-ll)  in  the  normal  access  area.  Centralized 
printer  subsystems  contain  data  spooling  areas  and  printers  which  are 
separated  according  to  classification  level.  The  operations  center  contains 
alphanumeric  keyboards  and  displays  for  messages  from  individual  processors. 
Centralized  operations  centers  are  backed  up  by  the  processor  consoles, 
although  they  contain  internally  redundant  hardware.  Data  downgrade  provides 
a manual  path  for  the  downgrade  of  data  using  low  capacity  storage  devices 
in  a configuration  similar  to  the  communications  subsystems,  with  switches 
for  connection  into  each  security  level  data  base.  Remote  jobs  may  be 
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entered  from  the  special  access  and  normal  access  data  downgrade  consoles  as 
an  additional  responsibility  of  the  subsystem.  This  allows  the  capability 
for  a higher  classification  area  to  initiate  lower  classification  runs. 

The  special  operations  console  allows  the  entering  of  data  directly  to 
different  security  level  data  bases  and  the  initiation  of  runs.  This  console 
is  mainly  switched  between  security  levels.  Support  processors  are  clustered 
together  to  provide  the  eoiitpyting  power  In  a pool  for  the  operations  oriented 
subsystems.  These  subsystems  are  located  along  the  top  of  the  AFGWC  Data 
System  Architecture  diagram. 

Data  storage  subsystems  are  located  in  the  special  And  normal  access  perimeters 
but  not  in  the  variable  access  perimeter.  This  is  to  allow  the  variable  access 
perimeter  to  switch  from  special  to  normal  access  support  as  fast  as  possible 
without  any  possibility  of  a security  violation  due  to  data  reamining.  If 
peripheral  sets  were  located  in  the  variable  access  perimeter  there  would  be 
the  possibility  that  a disk  pack  or  a tape  would  be  left  there  as  well  as 
causing  a several  minute  delay  for  dismount  and  storage.  Instead  a switch 
has  been  located  in  the  variable  access  perimeter  which  allows  physical  isolation 

Classified  data  base  subsystems  are  structured  such  that  disks  at  each 
classification  level  are  isolated  on  individual  control  units  which  are 
dedicated  to  classification  levels.  This  allows  the  disks  to  be  accessed 
and  have  a physical  path  only  from  certain  processors  without  any  possibility 
of  inadvertent  access  of  data  by  unauthorized  users. 

Control  units  for  the  disks  at  a given  security  level  are  redundant  to  provide 
the  ability  for  preventive  maintenance  while  the  system  is  still  accessible  to 
processors.  When  one  of  the  disk  control  units  is  not  taken  for  preventive 
maintenance  dual  control  units  provide  additional  performance  through  separate 
oaths  to  disk  packs. 

To  provide  for  the  number  of  interconnections  necessary  for  processors  to  be 
attached  to  many  different  data  bases,  it  is  also  necessary  to  have  a switching 
matrix  between  the  channels  and  the  disks'  control  units.  This  is  an  electronic 
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device  with  an  extremely  high  reliability;  it  is  modular  in  nature  such  that 
individual  switching  matrix  nodes  can  be  replaced  by  pulling  out  a module  and 
replacing  it  with  another. 

These  switching  matrices  essentially  allow  all  processors  to  be  connected  to 
all  data  bases  within  their  security  span  all  the  time.  This  avoids  switching 
transients  when  changing  roles  between  the  processors.  Therefore,  the  possibility 
of  processor  failure  due  to  unpredictable  transients  on  the  channels  is  eliminated. 
Protection  between  security  levels  is  provided  using  the  authentication  chips. 
Authentication  chip  keys  for  data  bases  are  manually  loaded.  They  have  no 
link  to  network  control.  This  is  an  additional  check  against  the  possibility 
of  inadvertent  access  since  their  authentication  keys  do  not  change  (unlike 
the  processors  which  are  modified). 

Redundant  disk  units  can  also  be  shared  among  security  levels  through  manual 
switching  arrangements.  Such  a possibility  may  lower  the  cost  below  SDC 
costing  with  redundancy  at  each  security  level.  (SDC  did  not  cost  the  lesser 
alternative  because  it  is  not  available  from  all  vendors  and  because  of  the 
possibility  that  it  is  not  security  acceptable  for  disk  subsystems  DS1  (B-5) 
and  DS2  (1-6))  Tape  control  units  are  connected  to  the  disk  control  units 
to  provide  a path  for  data  to  be  destaged  from  disk-to-control-to-tape  drives. 

Thus,  processors  can  leave  data  on  disks  that  will  eventually  be  written 
to  tape  without  direct  connection. 

This  alternative  may  or  may  not  be  cost  effective  for  individual  vendors 
and  so  SDC  has  specified  a hierarchy  of  alternatives  in  this  area,  the 
preferred  one  being  that  shown  in  the  diagram.  The  preferred  alternative  here 
illustrates  the  use  of  manually  mounted  and  dismounted  tapes.  However,  two 
other  alternatives  exist,  one  of  which  is  to  use  a mass  storage  facility  which 
contains  automated  mounting  and  disk  mounting  facilities  and  the  other  is  to 
dedicate  tape  drives  to  processor  systems. 

Four  different  kinds  of  disk  drives  have  been  used  in  the  data  base  subsystems. 

The  largest  capacity  drive  termed  "bulk"  is  similar  to  the  IBM  3330  Model  II. 
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This  disk  drive  provides  approximately  200  million  characters  of  capacity  per 
drive  and  is  the  most  cost  effective  in  terms  of  dollar  per  bit  stored. 


The  second  type  of  disk  drive  that  has  been  used,  termed  "combination", 
provides  faster  access  by  spreading  data  over  more  disk  drives  and  by  providing 
fixed  head  areas  as  a portion  of  each  disk  drive.  The  prototype  for  this  is 
the  IBM  3340  disk  drive. 


In  the  satellite  data  ingestion  area,  the  satellite  disk  has  been  specified. 

The  prototype  is  the  Univac  8440.  Specification  of  this  category  of  disk 
drive  allows  continuation  of  current  software  and  AF6WC  hardware.  In  addition, 
for  good  performance  on  mapping  and  gridding  it  is  necessary  to  have  the 
data  spread  over  more  disks  than  would  be  possible  with  the  3330  Model  II 
type  of  disk. 


Because  tie  support  processors  might  be  any  type  of  computer,  disks  currently 
available  for  attachment  to  support  processors  have  been  specified  for  all  of 
the  automated  work  center  data  storage  subsystems.  The  following  identifies  all 
of  the  storage  subsystems  on  the  AFGWC  Data  System  Architecture  diagram. 

Special  access  (B-5,  DS1),  normal  access  classified  (H-6,  DS2) , satellite 
data  (L-9 , DS3) , unclassified  central  data  base  (0-7,  DS4) , normal  access 
forecaster  support  (P-4),  special  access  forecaster  support  (E-2),  special 
access  printer  spooling  (C-ll),  and  normal  access  printer  spooling  (I -11). 


Interprocessor  communication  is  provided  through  the  control -only  and  upgrade 
links.  These  links  are  in  the  form  of  a central  routing  hub  rather  than 
individual  interprocessor  connections.  The  use  of  the  central  routing  hub 
provides  a means  for  growth.  Each  individual  processor  that  is  added  need 
only  be  connected  to  this  hub  rather  than  connected  to  all  of  the  additional 
processors  which  exist  in  the  network. 


The  path  for  control  information  exchange  between  a processor  at  one  security 
level  and  another  at  a lower  security  level  is  provided  through  the  control - 
only  link.  The  control -only  processor  not  only  provides  routing  of  information 
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but  restricts  the  bandwidth  and  symbol  set  which  can  be  exchanged  between 
processors  from  higher  to  lower  security  levels. 

The  upgrade  link  provides  an  exchange  of  information  between  processors 
from  a lower  to  an  equal  or  higher  security  level.  This  is  accomplished  as 
follows.  The  processor  may  request  an  upgrade  path  from  network  control. 

For  example,  suppose  that  the  requesting  processor  is  Unclassified  and  the 
destination  is  Top  Secret.  Network  control  would  provide  the  path  by  establish- 
ing hardware  mechanisms  within  the  upgrade  link.  Once  these  hardware  paths 
were  set  up  transmission  can  begin  from  the  unclassified  processor.  The 
data  is  routed  from  Unclassified  to  Confidential  level  and  from  Confidential 
to  Secret  level  and  from  Secret  to  Top  Secret  level  through  cascading 
authentication  devices.  Because  the  hardware  paths  always  take  data  from 
one  level  to  a higher  level,  there  is  no  possibility  of  inadvertent  access 
of  classified  information  by  a lower  classification  level. 

2.6  SYSTEM  MANAGEMENT  AND  OPERATION 

This  section  provides  an  overview  of  how  system  management  and  operation  is 
accomplished  within  the  enhanced  architecture.  Topics  discussed  include 
security,  network  control,  data  base  management,  and  data  system  interfaces. 
Security  in  the  enhanced  architecture  has  been  effected  without  the  use 
of  mixed  mode.  The  one  exception  to  this  is  in  the  communications  area  where 
mixed  mode  is  already  present  within  the  communications  lines  themselves. 

For  example.  Top  Secret  AUTODIN  can  carry  Secret,  Confidential  and 
Unclassified  messages  in  addition  to  Top  Secret  messages.  Therefore,  it  is 
essential  to  be  able  to  discriminate  the  classification  levels  of  messages 
within  communications  lines  and  downgrade  them  at  the  earliest  possible 
opportunity  within  the  data  system.  To  provide  for  this,  downgrade  takes 
place  within  the  communications  line  handler/decoder  router.  Several  different 
mechanisms  are  used  in  the  software  to  verify  the  classification  level  of 
messages  and  those  which  are  doubtful  can  be  routed  to  a communications  console 
for  manual  interpretation.  The  communications  console  provides  a means  for 
the  storage  of  messages  and  the  display  of  these  messages  on  a CRT.  Once 
the  communications  officer  determines  the  security  level  of  the  message,  he 
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has  a physically  separate  device  for  reading  the  message  back  into  the  system 
which  can  be  switched  into  any  security  level  line  handler/decoder  router.  The 
interface  between  line  handle r/<te'cu<ter  routers  and  the  interface  between  tie 
communications  console  and  the  line  handler/decoder  routers  are  treated  as 
communications  interfaces;  therefore,  they  are  not  included  in  hardware  and 
software  costs.  (The  line  handler/decoder  routers  and  the  communications  console 
are  included  in  the  system  cost.) 


The  bulk  of  AFGWC  equipment  is  contained  within  vaulted  areas,  the  exceptions 
being  forecaster  and  programmer  consoles.  Their  access  is  limited  to  processors 
and  data  bases  that  are  operating  at  an  unclassified  level.  All  classified 
software  development  takes  place  from  programmer  consoles  located  within  the 
vaulted  areas.  Isolation  of  processors  to  security  levels  is  accomplished 
through  authentication  devices  capable  of  encryption  and  decryption  at  channel 
transfer  rates.  Authentication  devices  attached  to  processor  systems  and  data 
bases  have  non-vulnerable  memories.  Those  which  are  attached  at  data  bases  are 
set  for  long  periods  of  time  and  can  be  loaded  via  locally  attached  devices 
through  manual  actions.  Processor  systems  have  their  memories  remoted  to  the 
network  control  computer  and  console,  so  that  they  can  be  switched  between 
classification  levels  in  a relatively  short  period  of  time. 


When  a processor  system  is  set  to  a security  level  it>  input/output  access 
paths  become  encrypted  at  that  security  level.  In  addition,  the  operating 
system  for  that  security  level  has  in  its  input/output  device 
tables  only  those  devices  which  are  classified.  If,  through  an  error  in 
software,  an  access  is  attempted  to  an  improper  security  level,  the  result 
will  be  an  authentication  error  which  will  cause  termination  of  any  further 
access  attempts.  The  status  will  be  returned  to  the  processor  which  can  in 
turn  pass  this  information  to  the  operations  console  and  the  network  control 
console  so  that  appropriate  recovery  action  can  be  taken. 


These  authentication  devices  will  be  transparent  to  diagnostics  and  access 
methods.  In  the  event  of  an  authentication  device  failure,  the  fail-safe  mode 
will  be  to  block  data  passage.  The  device  can  be  switched  out  and  replaced 
in  a matter  of  minutes. 
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All  downgrading  of  information  is  manually  approved  with  the  exception  of 
control-only  information.  Control-only  paths  exist  within  the  architecture 
to  allow  the  triggering  of  predetermined  responses  for  higher  and  lower 
classification  levels  (such  as  those  for  network  control,  directing  of  processor, 
and  telling  the  processor  to  look  on  its  job  queue).  This  control-only  link 
consists  of  a highly  restricted  bandwidth  and  a checking  mechanism  to  determine 
the  validity  of  control  characters  that  are  being  passed. 


A wide  range  of  possibilities  is  required  so  that  the  fairly  restricted, 
acceptable  ones  have  a low  probability  of  accidental  passage.  Attempts  to 
pass  illegal  characters  will  be  immediately  blocked.  This  security  approach 
provides  protection  only  against  inadvertent  access  data  rather  than  penetra- 
tion of  the  data  system  by  a hostile  intelligent  penetrator.  Protection  can 
be  restricted  to  this  level  because  the  entire  data  system  is  encompassed 
within  a classified  area  and  is  physically  protected  and  because  unclassified 
communication  links  cannot  introduce  new  software  into  the  system. 


Because  processor  systems  can  be  rapidly  switched  between  security  levels, 
either  upgrade  or  downgrade,  resources  can  be  allocated  in  response  to  priority 
missions  regardless  of  their  security  level.  In  addition,  the  processor 
systems  can  be  segmented  into  area  processors  which  can  be  run  at  different 
security  levels. 


Network  control  provides  essential  authority  for  resource  allocation,  system 
scheduling  and  status  monitoring.  To  prevent  an  overloading  of  network 
control,  some  of  the  functions  which  are  processor  system  peculiar  have  been 
off-loaded  to  another  hierarchy  of  scheduling  and  system  response,  the 
operations  console.  Network  control  establishes  the  state  of  the  data 
system  in  response  to  the  average  load.  If  peak  loads  occur,  network  control 
can  modify  the  state  by  switching  in  backup  resources  to  provide  more  through- 
put. In  the  event  of  a failure,  network  control  provides  a means  for  determining 
the  most  appropriate  response  on  a system  wide  basis.  To  do  this,  we  resort  to 
a shifting  of  functions  among  severe  1 processors.  This  is  possible  because 
there  is  a single  job  queue  maintained  by  network  control  which  is  parceled  out 
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to  individual  processors  and  because  all  processors  are  physically  connected 
to  data  bases  while  they  may  be  isolated  from  the  access  via  authentication  chips. 


Detailed  job  parameters  and  data  base  elements  are  left  at  individual  classification 
level  data  bases  by  support  processors  or  communications  oriented  line  handler/ 
data  routers.  Network  control  then  determines  which  processor  should  operate 
on  these  jobs  and  interrupts  it  to  notify  it  to  look  on  that  classification 
level  data  base  for  the  work  to  be  done.  When  the  processor  is  finished,  it 
interrupts  network  control  to  provide  the  information  as  to  the  location  of 
the  final  results.  Network  control,  having  kept  a record  of  where  the  job 
came  from,  then  tells  the  requestor  thst  his  information  is  ready  and  can  be 
obtained  from  the  appropriate  classification  level  data  base.  Network  control 
is  also  responsible  for  setting  the  switches  which  determine  the  hardware  inter- 
connections such  as  those  for  switching  in  backup  computers. 


Network  control  maintains  a nominal  predicted  load  schedule  and  a maintenance 
schedule  and  provides  the  authority  for  the  actual  removal  of  components  from 
the  data  system  for  maintenance.  Network  control  also  provides  a central 
point  for  the  integration  of  work  in  progress  status  and  for  the  status  of 
hardware  components  within  the  data  system. 


The  meteorological  data  base  has  been  centralized  and  is  under  the  control  of 
the  central  data  base  manager.  This  data  base  manager  is  one  of  the  main 
processor  systems  and  has  a backup  which  is  ready  to  take  over  in  the  event  of 
a software  or  hardware  failure  and  which  is  a different  main  processor  system. 
The  central  data  base  manager  receives  requests  from  other  processor  systems 
for  dat?  base  elements,  locates  those  data  base  elements,  and  transfers  them 
to  the  requesting  processor,.  Because  the  data  base  is  unclassified,  it  is 
necessary  to  have  overlays  which  are  contained  on  the  classified  disks.  The 
processor  requests  geographically  classified  information  from  the  central  data 
base  via  a broad  geographical  area  which  camouflages  the  nature  of  the  true 
request.  As  data  are  being  sent  to  the  processor,  they  are  filtered  down  to 
the  necessary  data  base  element  and  stored  on  disks.  At  the  same  time,  the 
classified  overlay  information  is  applied  to  the  data.  Therefore,  in  addition 
to  the  central  data  base  management  software,  it  is  necessary  to  have  local 
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2.7  SYSTEM  DESIGN  CONSIDERATIONS 


This  section  discusses  those  overriding  considerations  which  were  taken  into 
account  in  the  architecture  and  were  responsible  for  its  evolution  towards 
a final  form.  Such  considerations  include  flexibility,  growth,  the  forecast 
of  future  technology,  interpretation  of  key  driving  requirements,  questions 
of  reliability  and  maintainability,  manpower  and  physical  space.  To  provide 
flexibility  in  the  architecture,  it  is  necessary  to  provide  computational 
capacity  for  loading  peaks.  In  addition,  it  is  necessary  to  make  certain 
that  the  resources  of  the  architecture  can  be  applied  to  these  peaks  both 
at  varying  security  levels  and  in  terms  of  varying  functions  which  may  occur 
simultaneously  and  in  conflict  with  one  another.  This  problem  is  complicated 
by  the  possibilities  of  different  scenarios  for  peace  time  crises  and  war 
time.  In  addition,  it  is  necessary  to  minimize  the  amount  of  coupling  between 
functions  because  changes  to  functions  to  adapt  to  changes  in  requirements  now 
result  in  disastrous  ripple  effects  throughout  the  rest  of  the  data  system. 
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data  base  management  within  each  main  processor  which  is  less  elaborate  than 
the  central  data  base  software.  Central  data  management  is  also  responsible 
for  the  paging  of  data  sets  to  and  from  the  mass  storage  facility.  Central 
data  base  will  also  attempt  to  preformat  data  during  slack  periods  for  optimum 
running  of  models.  Data  requests  are  scheduled  ahead  of  time  because  network 
control  knows  of  the  upcoming  jobs  and  can  request  these  from  the  data  base 
manager.  The  data  base  manager  in  turn  can  make  certain  that  the  data  base 
elements  required  are  available  on  disk  by  staging  them  from  the  mass  storage 
facility  and  assure  that  they  are  in  the  proper  format  and  ready  to  be  accessed. 
Centralized  data  base  is  really  an  essential  point  of  the  architecture  because 
it  is  necessary  to  distribute  the  work  load  among  multiple  processors  in  order 
to  meet  scheduling  deadlines.  As  a result,  the  data  base  must  be  updated  con- 
currently from  several  different  processors.  Without  a central  data  base  it 
would  be  necessary  to  distribute  updates  among  all  processors  resulting  in  very 
high  traffic  and  the  possibility  of  conflicts  in  updates.  It  should  be  noted 
that  processors  will  be  downgraded  to  Unclassified  as  soon  as  possible  after 

being  upgraded  and  that  processor  systems  will  normally  be  in  the  unclassi- 
fied mode. 
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In  addition,  as  time  passes,  requirements  change,  and  some  of  the 
requirements  will  not  materialize  while  others  will.  The  architecture  provides 
flexibility  in  many  different  ways.  Protection  against  loading  at  different 
security  levels  and  for  conflicting  functions  provided  through  the  means  of 
network  control  with  the  buffering  of  resource  requests  on  disks  prior  to 
the  assignment  of  resources  to  process  functions.  In  addition,  because 
processors  can  "float"  between  security  levels,  it  is  possible  to  apply 
resources  against  many  different  functions  and  many  different  security  levels. 
This  can  be  contrasted  to  the  present  architecture  which  involves  a dedication 
of  systems  to  functions.  It  has  the  problem  that,  given  an  overload  scenario, 
it  is  necessary  to  bring  about  the  manual  switching  of  configurations  and  the 
difficulty  with  which  additional  processors  are  applied  to  problems  such  as 
computer  flight  plan  generation.  Coupling  between  functions  in  the  enhanced 
architecture  has  been  minimized  by  functionally  segmenting  the  system  and 
isolating  the  nucleus  of  main  processes  from  individual  dedicated  functional 
support  processes.  Changes  in  requirements  can  now  be  isolated  to  functional 
subsystems  such  as  communications  or  satellite  ingestion  without  an  effect 
on  the  rest  of  the  data  system.  Flexibility  has  also  been  provided  by  the  use 
of  large  scale  general  purpose  processors  and  where  necessary,  array  processors. 
Array  processors,  although  problem  specific,  are  still  flexible  in  that  they 
have  microcoded  control  memory  and  are  expandable  in  arithmetic  power  and 
memory  elements. 


Growth  of  the  data  system  has  been  provided  by  modularization  and  simple 
interfaces  such  that  additional  computer  power  or  data  storage  can  be  plugged 
into  the  architecture.  Computational  power  can  be  increased  by  a)  adding 
additional  processors,  either  support  processors  or  main  processors,  b)  by 
upgrading  main  processors,  taking  advantage  of  vendor  announcements,  or  c)  by 
the  addition  of  array  processors  to  handle  those  key  driving  requirements  with 
exceptionally  high  instruction  per  second  requirements. 


Storage  capacity  has  been  expanded  greatly  in  the  enhanced  architecture, 
primarily  by  the  addition  of  a mass  storage  facility  which  will  enable  the 
expansion  of  disks  via  a demand  paging  of  data  sets  to  and  from  tape  and  disks. 
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Disk  subsystems,  having  been  functionally  dedicated,  are  readily  expandable 
either  by  additional  disks  on  a control  unit  or  additional  control  units  and 
stri ngs. 

Main  memory  on  processors  is  not  as  constraining  as  it  is  under  the  current 
architecture  due  to  the  ability  of  network  control  to  schedule  jobs  in  such 
a manner  to  eliminate  memory  bottlenecks  which  cause  non-optimal  CPU 
utilization.  For  example,  software  development  jobs  and  communications  handling 
jobs  can  now  be  spread  among  processors  such  that  they  can  fill  in  between 
numerical  models  or  input/output  bound  functions.  The  communications  interface 
has  been  modularized  so  that  it  is  readily  expandable  with  the  addition  of 
more  line  handler/decoder  routers  or  the  upgrading  of  existing  line  handler/ 
decoder  routers.  Expansion  of  functions  currently  done  manually  which  would 
r&quire  additional  (unavailable)  manpower  has  been  minimized  as  a problem 
area  due  to  automation  in  the  use  of  interaction  with  the  data  system.  This 
can  be  seen  clearly  from  the  automated  work  centers  concept  that  has  been 
developed  for  the  enhanced  architecture. 

Satellite  data  ingestion  has  been  Isolated  and  removed  from  main  processor 
resources  which  are  now  free  to  take  on  other  jobs  while  data  is  being 
captured.  In  addition,  satellite  mapping  and  gridding  can  now  be  distributed 
over  several  processors  to  handle  the  multiple  satellite  passes  which  will 
occur  concurrently  in  the  future.  In  order  to  design  a data  system  of  this 
magnitude,  it  is  necessary  to  make  certain  assumptions  in  the  interpretation 
of  requirements.  These  assumptions  should  always  be  conservative  to  protect 
against  the  inherent  inability  of  people  to  define  future  requirements. 

In  addition,  because  requirements  are  compiled  individually  by  mission  oriented 
groups,  it  is  necessary  to  define  certain  overall  scenarios.  Examples  are 
the  conflict  probabilities  with  regard  to  simultaneous  running  of  numerical 
models,  data  ingestion,  mapping  and  gridding  of  satellite  passes,  and  the 
simultaneity  of  multiple  occurring  responses  at  different  security  levels. 


Again  the  data  system  has  been  designed  with  the  flexibility  to  encompass  the 
possibility  of  error  in  the  definition  of  requirements  or  the  interpretation 
of  requirements  and  the  fact  that  the  requirements  will  alter  with  time. 

For  example,  to  provide  against  multiple  conflict  situations,  the  architecture 
has  been  designed  with  five  main  processor  systems,  each  of  which  can  be  split 
into  two  resulting  in  a maximum  number  of  ten  main  processor  systems.  In 
addition,  each  main  processor  system  has  its  own  array  processor  since  physical 
cabling  distance  prevents  sharing.  Also,  several  array  processors  were  needed 
due  to  scheduling  conflicts.  Although  the  amount  of  classified  work  done  in 
the  facility  in  the  normal  access  area  is  relatively  small,  the  importance 
of  it  is  very  great.  In  a crisis  or  wartime  scenario,  such  type  of  work  will 
increase  unpredictably.  Therefore,  it  is  vital  that  the  data  system  be  able 
to  apply  resources  across  security  levels  with  a minimum  amount  of  effort. 

This,  of  course,  has  been  provided  as  mentioned  previously. 

Cost  is  always  a critical  factor  in  the  design  of  any  data  system.  Cost 
has  been  minimized  in  the  case  of  the  AFGWC  architecture  in  a number  of  ways. 
First,  the  main  processor  systems  have  been  designed  around  a capacity  level 
which  will  enable  the  reuse  of  existing  equipment  and  therefore  existing 
software.  Second,  cost  has  been  minimized  by  the  approach  of  staying  within 
the  center  of  the  industry  growth  pattern,  enabling  AFGWC  to  take  advantage 
of  a wide  customer  base  for  each  piece  of  equipment  it  will  procure.  Hence, 
it  will  always  have  good  software  and  maintenance  support  at  reasonable  prices. 
In  addition,  the  enhanced  architecture  has  taken  advantage  of  the  decrease  in 
physical  space  for  new  generations  of  processors,  so  that  growth  from  1975 
to  the  1982  configuration  can  be  provided  within  the  existing  physical  space 
without  expensive  construction.  Manpower  costs,  which  are  perhaps  secondary 
to  manpower  availability,  have  also  been  minimized  through  automation 
of  functions  done  manually  today  and  centralization  of  operations  which  support 
the  data  systems  such  as  printers  and  tape. 


2.8  IMPLEMENTATION  AND  COST 

Table  1 shows  an  implementation  schedule.  Note  that  the  majority  of  require- 
ments require  support  prior  to  1980  and  thus  the  schedule  is  heavily  front-ended. 

Table  1.  IMPLEMENTATION  SCHEDULE 

1977  - EARLY  1978  PROTOTYPE  DATA  BASE  PROCUREMENT 

UPGRADE  S/A  COMM 

EARLY  1978  2 NEW  PROCESSORS  OPS  CENTERS 

NEW  DATA  BASE  UPGRADE  AND 
CONTROL  ONLY 

MID  1978  REMAINING  PROCESSORS  UPGRADE 

SATELLITE  PROCESSING 
SIDE-BY-SIDE  COMM 

EARLY  1979  NETWORK  CONTROL 

MID  1979  AUTOMATED  WORK  CENTERS 

Table  2 shows  the  acquisition  cost  for  the  recommended  architecture.  These 
cost  figures  are  really  more  upper  bounds  than  they  are  best  guesses,  i.e., 
the  data  system  has  a 95%  chance  of  costing  less  than  the  figures  shown. 

Column  1 shows  assets  that  will  be  present  in  1977  (if  current  plans  are 
adhered  to)  and  reuseable.  The  second  column  shows  the  total  cost  of  the 
enhanced  architecture,  and  the  third  column  is  the  potential  1977  to  1982 
cost  based  on  retaining  the  baseline  assets,  i.e.,  column  3 is  equal  to 
column  2 minus  column  1. 
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Table  2.  ACQUISITION  COST  FOR  RECOMMENDED  ARCHITECTURE 


HARDWARE 

BASELINE 

ASSETS 

ARCHITECTURE 

COST 

POTENTIAL 
77  - 82 
COST 

PROCESSORS  & MAIN  MEMORIES 

$21. 9M 

$42. OM 

$20. 1M 

AUXILIARY  STORAGE 

$ 1.6M 

$ 6.8M 

$ 5.2M 

DATA  TRANSFER  & TERMINAL 
INTERFACE 

$ 0.04M 

$ 4.5M 

$ 4.5M 

CONSOLES,  DATA  INPUT  & 
DISPLAY 

$ 0.4M 

$ 6.0M 

$ 5.6M 

$23. 9M 

$59. 3M 

$35. 4M 

SOFTWARE 

DEVELOPMENT 

$ 2.0M 

$19. OM 

$17. OM 

CONVERSION 

$ 2.0M 

$ 5.9M 

$ 3.9M 

$ 4.0M 

$24. 9M 

$20. 9M 

TOTAL  COSTS: 

$27. 9M 

$84. 2M 

$56. 3M 
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2.9  SUMMARY 

The  SDC  design  is  complex;  however,  it  is  quite  simple  compared  to  the  very 
complex  problem  that  must  be  solved.  A simpler  design  could  undoubtedly  be 
accomplished,  but  we  feel  only  at  a decrease  in  reliability  or  a greater 
component  cost. 

The  present  design  is  the  least  expensive  of  the  primary  options  at  around 
$80  million.  The  alternatives  using  different  processors  cost  as  much  as 
50°/  more. 

A reassessment  of  requirements  could  reduce  the  cost  of  this  design.  The 
primary  targets  in  such  a cost  reduction  would  be  high  resolution  satellite 
data  processing  and  any  of  the  very  difficult  numerical  problems  (e.g..  Minute- 
man,  cloud  free  line  of  sight,  and  the  query/response  capability).  A 
reduction  in  the  reliability  requirement  would  also  have  some  effect  but  not 
until  it  was  significantly  reduced. 

The  next  steps  in  this  effort  are  obviously  detailed  design  and  study  in  the 
areas  identified  (especially  software)  and  a refinement  of  the  acquisition 
process.  Any  deviation  to  the  proposed  approach  should  be  thoroughly 
analyzed  since  many  of  the  features  are  subtly  interrelated. 

SDC  is  proud  of  this  design  and  has  high  confidence  that  it  is  a firm  basis 
for  an  architecture  to  support  AFGWC  requirements  through  1982. 
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